CVE-2026-20836CWE-362

CVE-2026-20836

High · published January 13, 2026

CVSS v3.1
7.0
EPSS
0%
Percentile
20.5
In the wild
Unconfirmed
What it is

⚡ A sneaky race condition in the Graphics Kernel lets authorized users elevate their privileges with a little timing trickery! 🎢 Think of it like two chefs trying to grab the last slice of cake at the same time. If one chef isn't fast enough, the other could take the whole cake without anyone noticing! This race condition could allow a malicious user to take over administrative privileges, accessing sensitive data and making unauthorized changes. Essentially, it's like giving a guest the master key to your house—yikes! 🔑

Put simply

Think of it like two chefs trying to grab the last slice of cake at the same time. If one chef isn't fast enough, the other could take the whole cake without anyone noticing! The vulnerability arises from improper synchronization when multiple processes access shared resources concurrently, enabling an attacker with local access to escalate their privileges without detection.

What to do

This race condition could allow a malicious user to take over administrative privileges, accessing sensitive data and making unauthorized changes. Essentially, it's like giving a guest the master key to your house—yikes! 🔑 To remediate this, ensure your Graphics Kernel is updated to the latest version provided by your vendor. Additionally, review your synchronization mechanisms to prevent concurrent access conflicts. Don't let this slip through the cracks! You've got this! Follow these steps, and you'll be fortifying your defenses in no time! 🛡️

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00291 · 20.5th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-01-13T23:16Z
Affected products (14)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
microsoft/windows_server_2016< 10.0.14393.878310.0.14393.8783
microsoft/windows_server_2019< 10.0.17763.827610.0.17763.8276
microsoft/windows_server_2022< 10.0.20348.464810.0.20348.4648
microsoft/windows_server_2022_23h2< 10.0.25398.209210.0.25398.2092
microsoft/windows_server_2025< 10.0.26100.3223010.0.26100.32230
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    DirectX Graphics Kernel Elevation of Privilege Vulnerability
    cvelistv5